fesco

#3504 Change: Enforcing_signature_checking_by_default
Closed: Accepted by zbyszek. Opened by alking.

Closed: Accepted
Reopen Issue

Change the RPM default package verification mode to enforcing signature checking, to follow upstream RPM 6.0 default: only packages with a verified signature can be installed, unless explicitly overridden by --nosignature or corresponding API.

Owners, do not implement this work until the FESCo vote has explicitly ended.
The Fedora Program Manager will create a tracking bug in Bugzilla for this Change, which is your indication to proceed. See the FESCo ticket policy and the Changes policy for more information.

REMINDER: This ticket is for FESCo members to vote on the proposal. Further discussion should happen in the Discourse discussion linked above. Additional discussion may happen on the Fedora Devel mailing list.

I'm sure that this will cause pain in various places, but I think we should do this and deal with any issues as they are discovered. The sooner we switch rawhide to the new scheme the better.

+1

The signing setup script should move to /usr/bin, but otherwise it seems reasonable. I expect a lot of pain, though.

+1

Metadata Update from @alking:
- Issue assigned to pmatilai

+1

+1 - wearing my ELN hat as well, better have this early than late, as Fedora 46 will be branched to CentOS Stream 11

After a week: APPROVED (+4, 0, 0)

Announced: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/QB7SUIXOWCFUO24SU2GPLBRXBYHY7OBW/

Metadata Update from @zbyszek:
- Issue close_status updated to: Accepted
- Issue status updated to: Closed (was: Open)

FYI, we'll proceed with this in January to be on the safe side:
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/BYG3JSPRB3R2YQWP6O3ZD2GMNFRVM7JS/

This Change has been deferred to F45 (i.e. after the F44 branch point), can we get all the things updated accordingly please?

Metadata Update from @alking:
- Issue set to the milestone: Fedora Linux 45 (was: Fedora Linux 44)

The deferral has now been processed:

✅ Wiki updated from F44 to F45
✅ Bugzilla tracker moved from F44Changes to F45Changes
✅ F44 ChangeSet updated (change removed)
✅ F45 ChangeSet updated (change added, no duplicates)
✅ Discourse discussion notified
✅ FESCo milestone updates

Thank you!
Metadata

system wide change

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.